Legal · last updated 2026-10-31
Privacy notice
This notice covers this website (letsosint.com) and the Let's OSINT training platform (app.letsosint.com). The controller is the operator named in the legal notice. Questions and requests: contact@letsosint.com.
This website
The marketing site sets no cookies and runs no analytics and no third-party scripts. Like any web server, ours writes technical access logs (date, page requested, browser user agent, and your IP address truncated to its first three bytes for IPv4, or 48 bits for IPv6). They are used for security and troubleshooting only and are overwritten on a rolling basis, within a few weeks at most.
Your account on the platform
When you create an account and train on app.letsosint.com, we process:
- Account data: email address, the name you give (if any), and sign-in data. If you choose to continue with Google, Google shares your name, email address and profile picture with us.
- Training data: the Cases and modules you start, your answers, notes, pinned evidence, scores and results.
- Security data: session cookies strictly necessary to keep you signed in, and technical logs (truncated IP address, date, request) to protect the service against abuse.
The platform has no advertising, no analytics and no tracking cookies. Everything is free during early access: no payment data is collected. Please do not enter real personal data about other people in notes or answers: every Case is fictional.
Why, and on what legal basis
- Providing the training service and your account (GDPR Art. 6(1)(b), performance of the contract you accept when you sign up).
- Keeping the service secure and preventing abuse, and answering your messages (Art. 6(1)(f), our legitimate interest).
We do not sell, rent or share your data for advertising, and we do not profile you.
How long
- Account and training data: for as long as your account exists. Ask us to close it and we delete them within one month.
- Encrypted backups: at most five weeks, after which they are overwritten.
- Technical logs: a few weeks at most (rolling).
- Emails you send us: as long as needed to answer, then at most three years.
Who processes it, and where
- OVHcloud (OVH SAS, France) hosts our server in its Beauharnois data centre (Québec, Canada): this website, the platform and its database. The European Commission has recognised that Canada provides an adequate level of protection for personal data (adequacy decision 2002/2/EC). Off-site encrypted backups are stored with OVHcloud in France.
- Clerk, Inc. (United States) handles sign-up, sign-in and sessions for the platform, as our processor. Its sign-up form may use Cloudflare Turnstile to block bots. Transfers to the United States rely on the EU–US Data Privacy Framework (Clerk is certified) and, as a fallback, the EU Standard Contractual Clauses.
These providers act on our instructions only and may not use your data for their own purposes.
Your rights
- access the data we hold about you, and get a copy (portability);
- have it corrected or deleted, including closing your account;
- object to or restrict processing based on our legitimate interest;
- lodge a complaint with a data protection authority (in France, the CNIL:
cnil.fr).
Write to contact@letsosint.com from the address of your account. We answer within one month.
Changes
If this notice changes in a way that matters, we will update the date above and tell account holders by email before the change applies. See also the terms of use.